CVE-2026-82369— Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
Quick assessment
Affected
Brocade SANnav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Brocade SANnav 命令行界面（CLI）脚本组件存在对 Shell 元字符输入验证不足的缺陷，使得已认证用户能够突破受管交换机上的受限执行环境。拥有命令执行权限的攻击者可利用此漏洞，绕过命令白名单限制，在目标 Fabric 交换机上执行未授权的 Shell 命令，从而获取交换机完全的管理员访问权限。此漏洞影响所有低于 3.0.1a 版本的 Brocade SANnav。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82369
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This vulnerability affects all Brocade SANnav versions before 3.0.1a.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82369
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82369
请登录查看更多情报信息。
Other References for CVE-2026-82369 (1)
Same Patch Batch · Brocade · 2026-09-23 · 3 CVEs total
| CVE-2026-82368 | 8.7 HIGH | Brocade SANnav 3.0.1a前本地非授权访问漏洞 |
| CVE-2026-82370 | 8.6 HIGH | Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service |
IV. Related Vulnerabilities
Same product: SANnav
-
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem -
CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparis -
CVE-2026-14442
Information exposure vulnerability in the job scheduling com -
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collect -
CVE-2026-82372
Improper handling of sensitive data during IPsec policy crea
Same vendor: Brocade
-
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem -
CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparis -
CVE-2026-14442
Information exposure vulnerability in the job scheduling com -
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collect -
CVE-2026-82372
Improper handling of sensitive data during IPsec policy crea
Same weakness: CWE-78
-
CVE-2026-101076
Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command -
CVE-2026-101075
Netcore NR289-GE Location Time location_time.cgi system os c -
CVE-2026-4556
macOS Exam4 Local Privilege Escalation via Command Injection -
CVE-2026-101072
Netcore NR289-GE CGI ap_ip.cgi system os command injection -
CVE-2026-86330
Noobaa-core: noobaa-core: os command injection in cluster_in
V. Comments for CVE-2026-82369
No comments yet